Mobile Security The Essential Ingredient In Todays Enterprise Wp091046
White Paper: Mobile SecurityMobile Security:The Essential Ingredientfor Today’s Enterprise In a well-publicized case, a data analyst em- ployed by the U.S. Department of Veterans Affairs (VA) took his laptop home to suburban Maryland. Burglars entered his home and stole the laptop. Suddenly, the personal information of some 26.5 million veterans was at risk. The incident became an international news story raising caution flags about managed security at the VA. Incidents like this one are not unusual today, and the risk is increas- ing as the mobile workforce grows. Gartner reports that 83.9 percent of businesses have a remote workforce, and by 2011 an estimated 46 million employees globally will telecommute at least one day per week and 112 million will work from home at least one day per month. Software and technology solutions help mitigate security risks and safeguard organizations from threats, but they require IT staff to select, deploy and maintain them. The problem is, today’s IT environments are lean. This paper examines the current mobile security landscape, including myths surrounding the risks and threats, and how organiza- tions can establish a solid mobile security strategy.
Qwest White Paper: Mobile SecurityThe Mobile Landscape a work-from-anywhere preference. However, working outside the office guarded by firewalls and intrusionThe mobile workforce is increasing. More than 17 mil- measures can increase risks for businesses. Dispersedlion Americans got their work done via telecommuting employees have lower visibility than those in the office.in 2008, a 74 percent increase over the previous three It requires resources, time and technology to remotelyyears, according to WorldatWork Telework Trendlines. monitor and control which sites users visit, the informa-How is this changing our workforce? Mobile work tion they exchange and the online connections they use.encourages cross-pollination of different cultures with “Given our business as an international communicationsfresh ideas and innovative practices for collaborative solution provider, our challenges are often compoundedteams. In a telecommuting survey sponsored by Robert by the need to support customers and business func-Half International, 53 percent of respondents said the tions in a variety of locations,” says Michael Glenn,ability to work at home is important to their employment director of Information Security and chief informationchoice. In the most recent annual telework survey by security official (CISO) at Qwest Communications Inter-CDW Corp., 40 percent of the respondents agreed that national Inc., a managed security provider.“the option to telecommute would influence their deci-sion to remain with their employer or take a new job.” Employees now connect and work via wireless networks and Wi-Fi hotspots and expect to access data 24x7 fromOn the one hand, teleworkers help alleviate the daily mi- their personal smartphones. Unencrypted wireless ac-nutiae of managing in-house employees, giving manage- cess points often do not offer the security levels neces-ment more time to strategically develop initiatives. But sary to protect corporate data. Unencrypted public wire-on the other hand, a dispersed team of mobile workers less access makes it possible for an outsider to detect acreates more work and new concerns for IT managers. user, enter a wireless network and potentially steal data.For example, in a recent survey of CIOs, 45 percent said The same scenario is not true with encryption, wherethey were not confident that their company’s policies data is modified to prevent access.and security measures prevent mobile employees fromsending confidential information to unauthorized third Unencrypted hotspots are causing concern about the in-parties—such as sending company information from a tegrity and safety of wireless access; 47 percent of CIOslaptop to a home PC (IDG Research Services on behalf of and IT leaders say they are not very or not at all confidentFiberlink Communications, 2008). that their company’s policies and security measures pre-Ensuring security is a formidable challenge for IT manag- vent mobile employees from accessing the Internet viaers. Mobility creates opportunity for hackers and preda- unencrypted public wireless access points (IDG Researchtors and increases other threats and vulnerabilities. It Services for Fiberlink Communications, 2008).requires a new approach to security management, in- Myth 2: Existing mobile security programs are goodcluding an assessment of security plans and policies and, enough as is and don’t require investment or long-termultimately, the creation of a mobile security strategy. planning.Identifying Myths Many IT managers believe that their existing mobile policies are sufficient to mitigate risk. However, vulner-Before development of a strategy for securing mobile abilities and threats constantly change, as do the waysworkers and data, some common myths about IT secu- predators exploit weaknesses in IT infrastructure.rity practices should be clarified and dispelled. Mobile users and the technology used to accommodateMyth 1: Having a core security program in the office them are growing and changing. For example, it tookenvironment means that IT assets and data are safe BlackBerry five years to get its first million users, justeverywhere. another 10 months to get its second million and sixMobile security is not confined to the office or headquar- months for the next million. Today the company hasters location. Wherever a mobile worker goes, so goes more than 28 million users. The steep increase in usagea virtual office. The price and performance of laptops, and the evolving need for new features and capabilitiescoupled with wireless access availability, have created have heightened the risks and vulnerabilities. 
Qwest White Paper: Mobile SecurityComplying with encryption regulations and controlling rity concerns are the leading objection to outsourcing.threats requires vigilant monitoring processes, because However, roughly half of these IT executives reportedblind spots exist when assets are deployed in remote that they are still likely to outsource some type of data,places. Workers travel everywhere with their laptops, voice or network service over the next 18 months (IDGsmartphones and other equipment. They can work virtu- Research Services and Fortune on behalf of Qwest Com-ally anywhere. An unnoticed vulnerability potentially munications, May 2009). In the research, cost savingsexposes proprietary data to unwanted parties. were the most frequently cited benefit of outsourcing, followed by access to expertise.Myth 3: Do-it-yourself managed mobile security is abetter, less costly alternative to outsourcing. Building an in-house program requires staff and technol-In recent research, CIOs declared that privacy and secu- ogy, and ultimately, investment. And sometimes havingFive Steps to Reduce 3. DEVEloP a SPEciFic Policy to PRotEct thE oRganizationMobile Blind Spots r Develop a policy for damaged, lost or stolen mobileToday’s mobile workers are everywhere. From their kitchen devices, and protect sensitive information as necessary.tables to airports to remote office locations to headquar- r Monitor deployment of encryption tools, and preventters offices, they roam past geographic boundaries and employees from copying or distributing sensitive data.operate on many different networks. A wide variety of Ensure your company’s ability to meet e-discoveryvulnerabilities can potentially threaten and damage an obligations.organization’s IT systems and data. Here are five steps se-curity managers can take to reduce these risks and ensure r Make sure your policies enable you to monitor companythat mobile blind spots do not bring unwanted publicity data and meet all compliance and legal obligations fromand costs to the organization. company-issued as well as personal mobile devices. r Track and document the status and condition of mobile1. EnSuRE ViSiBility and remote systems software.r Continually monitor the health and compliance of all laptops with tools for monitoring applications, flagging 4. tiE accESS to DiREctoRiES, iDEntitiES those that are out of company compliance and encrypt- anD RolES ing and locking down sensitive data deployed in r Allow access to the resources on the corporate net- a laptop or other device. work based on the individual, that person’s role andr Enforce policies and do remediation as needed. organizational policy. r Ensure that licensed content, digital rights and the2. PRotEct SEnSitiVE Data on BuSinESS distribution of content are protected. EnDPointS r Secure integrated communications for VoIP, e-mail andr Monitor, protect and update mobile devices, including e-commerce transactions. those outside the corporate LAN, with tools that provide r Enable the image that appears on the remote workstation secure access to the company network via an optional to be identical to that on the home office workstation. virtual private network (VPN) client, as well as authenti- cation and encryption. 5. EnFoRcE PRoDuctiVityr Monitor and enforce rules about and remediate obso- r Notify employees that instant message conversations lete software. Provide adequate security protection for are monitored and that logs are stored for possible device use from any location. management review and e-discovery obligations.r Disable noncompliant endpoints. r Monitor, audit and collect usage statistics for manage-r Set boundaries for information transfer. ment purposes. 
Qwest White Paper: Mobile Securityan internal, dedicated staff equipped with the most-up- Complying with regulations and identifying vulner-to-date security technologies can turn out to be more abilities are significant business benefits of using anexpensive than hiring a managed service provider. It’s outsourced mobile security partner. A provider can alsoimportant to perform a cost analysis of do-it-yourself help prevent costly incidents that degrade the brandversus outsourced managed security. identity of the organization and that have extended costs. For example, the Department of Veterans Af-Myth 4: In-house staff is always up to date on the fairs incident led to an outcry from the general publiclatest security threats and trained in the processes, and government leaders who questioned the securitysolutions and equipment needed to combat them. governance of its mobile workers. This reflected on theManaged security providers bring expertise in finding integrity of the organization.solutions to fit complex problems, solutions that may In addition, a security breach has costs that extendnot be available in-house. With cross-industry experi- beyond those directly related to the incident. A recentence, an outsourcing provider must stay abreast of study by the Ponemon Institute found that the loss of onedeveloping threats and investigate products and secu- laptop costs an average of $49,246. On top of the actualrity solutions to address them. Their experience affords replacement of the notebook, larger expenses includerecommendations that save time and money. costs associated with investigating the incident, the loss of intellectual property and data and compliance withThe Compliance Conundrum regulatory requirements related to the breach.Understanding misconceptions is the first step toward A managed security provider can help protect the or-improving mobile security. However, the steady growth ganization by establishing a mobile security strategy toof industry compliance requirements makes the task of prevent such incidents. For example, having a compre-managing it even more daunting. hensive inventory of mobile assets and the ability to re- motely disable them can prevent consequential damageSome of these regulations, or parts of them, promote from theft and intrusion by predators.data protection within particular industries. For ex-ample, the Gramm-Leach-Bliley Act (GLBA) has privacy A managed security partner also provides metrics forstipulations to protect information in the financial ongoing security maintenance and protection—such asservices industry. The Healthcare Insurance Portability how mobile workers communicate, how often they areand Accountability Act (HIPAA) sets standards for health online, the Web sites they visit and when and how datacare coverage and transactions, including safe-harbor is exchanged. This knowledge aids in decision-makingprovisions if data is encrypted to specific standards. and overall security strategy.Payment Card Industry (PCI) standards govern data usedin payment card transactions. The U.S. Federal Trade ConclusionCommission (FTC) also has information protection rulesthat apply. Not meeting compliance requirements can Our universal mobile workforce is steadily growing. Like-mean hefty fines and expensive consequences. wise, the need to manage the security of the devices and data used by these workers is also increasing. It’sIn addition, some states in the U.S.—including Massa- important to understand the challenges and miscon-chusetts and Nevada—will soon require encryption on ceptions about security in terms of complacency, cost,all mobile devices, including smartphones, if they con- experience and do-it-yourself security management.tain personal information. Further, companies must be In addition, a rise in compliance requirements hasable to retrieve data from mobile devices if the informa- caused IT managers with limited resources to seek out-tion is pertinent to a discovery motion or lawsuit. side help to meet these requirements. Having a mobileNew compliance requirements necessitate safeguards security program that incorporates a trusted managedsuch as network monitoring, data tracking, firewall con- security provider is a best business practice and an es-figuration and access control programs—areas where sential ingredient in protecting today’s enterprises.outsourced security services are valuable. For more information, visit www.qwest.com/business.